Now that we've obtained an SSL certificate, let's apply it. This is typically applied to a web server like Nginx, or a WAS like Tomcat.

This chapter explains the process based on Tomcat 9.0.50.

Let's apply the certificate to Tomcat. The method differs depending on whether Tomcat Native is installed.

Tomcat Native
Native modules written in C and JAVA are added to improve Tomcat's performance. On Windows, all you need to do is move a single dll file.

If Tomcat Native is set up, you can apply the pem file directly; otherwise, you need to convert pem into a compatible format such as jks.

The method for installing Tomcat Native differs depending on the OS. SSL can be applied without installing Tomcat Native, so feel free to skip this step if you're not interested.

Download the Tomcat Native library from this link. Download [Native 1.2.30 Windows Binaries.zip] partway down the page.

After extracting it, you'll find tcnative-1.dll in the [bin] folder — installation is complete once you move that DLL to TOMCAT_HOME_HOME/bin.

BASH
yum -y install tomcat-native

If you're on CentOS 7, just run the command above. If a command like this isn't available to you, you'll need to compile it yourself directly from this link.

You compile the source code yourself. This is explained based on CentOS.

BASH
yum install apr-devel openssl-devel

Or, if you're on a Debian-based system:

BASH
apt-get install libapr1.0-dev libssl-dev

The tools above need to be installed before compiling.

Download [Native 1.2.30 Source Release tar.gz] from this link and extract it.

BASH
tar -zxvf Native 1.2.30 Source Release tar.gz

Extract it using the command above; the exact command may differ depending on your OS.

BASH
cd ${extraction_path}
./configure --with-apr=/usr --prefix=${current_path} --with-java-home=${JAVA_HOME}
make
make install

Just run the commands above in sequence.

Let's apply the SSL certificate. The method differs depending on whether Tomcat Native is applied.

Open the TOMCAT_HOME/conf/server.xml file.

XML
<Connector protocol="org.apache.coyote.http11.Http11NioProtocol"
	port="443"
	scheme="https"
	secure="true"
	SSLEnabled="true"
	SSLCertificateFile="example.com-crt.pem"
	SSLCertificateKeyFile="example.com-key.pem"
	sslProtocol="TLS" />

Just edit it as shown above. Set the path to the crt.pem file in SSLCertificateFile, and the path to the key.pem file in SSLCertificateKeyFile.

If, for whatever reason, you can't install Tomcat Native, a regular Tomcat install can't recognize PEM files. So you need to convert it into a format Tomcat supports. In this document, we'll convert it into a .jks file and apply that instead.

Here's what you'll need:

• OpenSSL
• keytool (comes bundled with JAVA)

You need to install OpenSSL yourself, but keytool is located in JAVA_HOME/bin, so if you have JAVA installed, there's no need to install it separately.

BATCH
# pem to p12
openssl pkcs12 -export -out {name}.p12 -in {crt}.pem -inkey {key}.pem

# p12 to jks
keytool -importkeystore -srckeystore {name}.p12 -srcstoretype pkcs12 -destkeystore {name}.jks -deststoretype jks

Just run the commands above in order. During the conversion process, you'll be asked for a password to store with the certificate. You'll need to provide this same password to the web server later on, so make sure to remember it.

Unlike the 4 .pem files, .jks is simple and generates just a single file. Once it's generated, open the TOMCAT_HOME/conf/server.xml file.

XML
<Connector protocol="org.apache.coyote.http11.Http11NioProtocol"
	port="443"
	scheme="https"
	secure="true"
	SSLEnabled="true"
	keystoreFile="example.com.jks"
	keystorePass="password"
	sslProtocol="TLS" />

Enter the .jks file you generated in keystoreFile, and the password you entered during the conversion process in keystorePass.

In this document, the SSL port was set to 443. Since 443 is the default port for SSL, it will connect automatically without needing to specify the port separately.

Now start up Tomcat and try accessing your domain. If the certificate information shows up correctly, you've succeeded.

For reference, the certificate operates based on the domain. If you access it via localhost, 127.0.0.1, or an IP address, a certificate error will appear, so keep that in mind.

With this, SSL has been successfully applied. It might look a bit complicated at first, but once you've done it once, there's really nothing too difficult about it.

Let's Encrypt is the easiest and fastest way to obtain a DV certificate for free, so make good use of it whenever you need SSL.